# PLT-001: Minimize endpoint and network architecture risk


- Area: Platform, Privacy & Assurance

- Verification: Documentation
- OWASP adoption tier: AT0–AT4
- Formerly: ARC-006
- URL: /r/PLT-001

**Acceptance criteria:** Support agentless and optional-agent patterns, and avoid kernel mode, reverse proxy and major network changes unless justified and tested.

**Why it matters:** Kernel components, proxies and network changes add operational risk that should be justified.

**How to verify:** The vendor documents the deployment architecture and justifies any privileged component.

**OWASP adoption context:** Endpoint and network design risks span the listed employee AI settings; broad coverage should not assume that one deployment architecture fits every surface.

**Mappings:**
- SOC 2: CC6.1, CC8.1; ISO 27001: A.8.27, A.8.29 — Justified, tested deployment choices provide secure-architecture, configuration and change/acceptance-review inputs and can reduce unnecessary privileged interception exposure. Agentless deployment is not intrinsically more secure, and these frameworks do not prohibit kernel components or reverse proxies.
- NIST AI RMF: MAP 4.2 — Agent choices and justified network changes document AI component controls, computing resources and deployment requirements. Tests provide readiness evidence, but the configuration still needs assessment in the actual deployment environment.
- ISO 42001: A.6.2.5 — Justified and tested deployment choices provide readiness evidence when assessed against a defined deployment plan and acceptance criteria. Avoiding kernel components or reverse proxies is not itself resource documentation or proof of safe deployment.
- NIST CSF 2.0: PR.PS-01 — Justified, tested deployment choices can provide configuration-acceptance evidence when assessed against a security baseline. Agentless deployment is not inherently safer, and avoiding a technology class does not establish a network-access safeguard.